France Accuses Russia’s GRU of Sustained Cyberattacks Targeting Critical Infrastructure and Undermining Democratic Processes
France has publicly accused Russia’s Main Directorate of the General Staff of the Armed Forces (GRU) of orchestrating a persistent campaign of cyberattacks against French institutions, businesses, and even the 2024 Olympic Games organizing committee. This marks the first time Paris has leveled such accusations based on its own intelligence assessments, solidifying a growing international consensus on Russia’s malicious cyber activities. The French Foreign Ministry identified GRU unit APT28, also known as “Fancy Bear,” as the perpetrator of these attacks, tracing their activities back to at least 2015. The ministry linked APT28 to the disruption of TV5Monde’s broadcast signal in 2015 and interference in the 2017 French presidential election through the dissemination of hacked emails and disinformation targeting Emmanuel Macron’s campaign.
The French government’s accusations detail a wide range of targets, including ministries, defense contractors, think tanks, aerospace firms, and organizations involved in the 2024 Olympic and Paralympic Games. The attacks aim to destabilize France, gather strategic intelligence, and undermine public trust. French authorities noted a significant surge in cyberattacks attributed to Russian actors in 2024, with approximately 4,000 incidents recorded – a 15% increase compared to the previous year. The most recent APT28 attack identified by French authorities occurred in December 2024. These revelations come amidst escalating geopolitical tensions and highlight the growing threat of state-sponsored cyber warfare.
The French National Cybersecurity Agency (ANSSI) provided further details, outlining APT28’s tactics, which include phishing campaigns targeting personal email accounts to gain access to sensitive data and infiltrate systems. These campaigns have targeted individuals in France, Europe, Ukraine, and North America. ANSSI observed that APT28 has widened its net by deploying fake login pages mimicking various email services, including UKR.NET, Yahoo, ZimbraMail, and Outlook Web Access. This sophisticated approach underscores the group’s technical capabilities and its determination to compromise a broad spectrum of targets.
France’s accusations resonate with similar concerns expressed by other Western nations, who have also identified APT28 as a key player in Russia’s cyber operations. In 2024, Germany accused APT28 of targeting its defense and aerospace companies, as well as the country’s ruling party. The United States has long attributed APT28’s involvement in the 2016 presidential election, specifically the release of emails from the Democratic National Committee and Hillary Clinton’s campaign. These converging assessments paint a clear picture of Russia’s persistent use of cyberattacks as a tool of foreign policy, aimed at disrupting democratic processes, sowing discord, and gaining strategic advantages.
The timing of these renewed cyberattacks coincides with France’s strong support for Ukraine following the Russian invasion in February 2022, suggesting a retaliatory motive. French Foreign Minister Jean-Noël Barrot addressed the UN Security Council, directly accusing Russia of these actions and demanding their immediate cessation. Barrot’s condemnation, delivered in the presence of Russia’s representative, underscored the seriousness of the issue and France’s resolve to counter these malicious activities. He labelled the attacks as “unworthy of a permanent member of the Security Council” and a violation of UN frameworks.
Beyond direct cyberattacks, France has also been a prime target of Russian disinformation campaigns, particularly during the 2024 European Parliament elections and the subsequent political crisis following the snap parliamentary elections in July. These campaigns sought to undermine Western support for Ukraine, amplify internal divisions, and erode public trust in democratic institutions. A report by the European External Action Service (EEAS) identified France as one of the primary targets of hostile information manipulation efforts, with numerous cases linked to the Russian disinformation ecosystem. These campaigns often involve impersonating legitimate media outlets and government websites, disseminating fabricated news stories, and utilizing coordinated networks of fake social media accounts to amplify their reach. France’s experience highlights the multifaceted nature of Russia’s information warfare tactics, which combine cyberattacks with sophisticated disinformation campaigns to achieve strategic objectives.